d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348 | Triage

Analysis

max time kernel
83s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:52

Sharing

Report Analysis Logs

General

Target

hintsok.dll
Size

274KB
MD5

a285e5f846809642c0bf7900bab1216b
SHA1

bfd55653ae8ae1eb32a6a6207dbc5df46195517b
SHA256

f9cbd173e31342657247856037dac44e7ba1398b0c15aa4bb19784811e0fc0fd
SHA512

c677421406696bd766b02b6367ea29482232b0216379e43dd2fdaa4acac92962061c48898c38ac227fdd0263eebb23a4295575c0664161fb166ba0abe17d1ab9
SSDEEP

6144:oR52MsvCyT0hnT8Q4oHY3Spf6Is7X/zC/xwsI3tgIYtVd:I52MsvCyT0hc6SIsb/zCAgI4d

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4728 wrote to memory of 1080	4728	rundll32.exe	rundll32.exe
PID 4728 wrote to memory of 1080	4728	rundll32.exe	rundll32.exe
PID 4728 wrote to memory of 1080	4728	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintsok.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hintsok.dll,#1
2⤵
PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-132-0x0000000000000000-mapping.dmp

Download